Re: [PATCH 1/5] x86/sme: Clear decrypted BSS separately

[Brian Gerst]

On Fri, Jul 24, 2026 at 12:42 PM Tom Lendacky <thomas.lendacky@xxxxxxx> wrote:
>
> On 7/23/26 22:02, Brian Gerst wrote:
> > The decrypted BSS section needs to be cleared after it is remapped as
> > decrypted memory.  Separate it so that the normal BSS section can be
> > cleared earlier.
> >
> > Signed-off-by: Brian Gerst <brgerst@xxxxxxxxx>
> > ---
> >  arch/x86/kernel/vmlinux.lds.S | 2 +-
> >  arch/x86/mm/mem_encrypt_amd.c | 3 +++
> >  2 files changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
> > index 2438b89a4620..e64c797e06c7 100644
> > --- a/arch/x86/kernel/vmlinux.lds.S
> > +++ b/arch/x86/kernel/vmlinux.lds.S
> > @@ -365,9 +365,9 @@ SECTIONS
> >               *(.bss..page_aligned)
> >               . = ALIGN(PAGE_SIZE);
> >               *(BSS_MAIN)
> > -             BSS_DECRYPTED
> >               . = ALIGN(PAGE_SIZE);
> >               __bss_stop = .;
> > +             BSS_DECRYPTED
> >       }
> >
> >       /*
> > diff --git a/arch/x86/mm/mem_encrypt_amd.c b/arch/x86/mm/mem_encrypt_amd.c
> > index 2f8c32173972..d39e1e29bcb9 100644
> > --- a/arch/x86/mm/mem_encrypt_amd.c
> > +++ b/arch/x86/mm/mem_encrypt_amd.c
> > @@ -479,6 +479,9 @@ void __init sme_early_init(void)
> >       if (!sme_me_mask)
> >               return;
> >
> > +     memset(__start_bss_decrypted, 0,
> > +            (unsigned long) __end_bss_decrypted - (unsigned long) __start_bss_decrypted);
> > +
>
> I think this section needs to be cleared to zero regardless of whether SME
> or SEV (this section is mainly used for SEV) is active. For example KVM
> clock makes use of this section even if SEV is not active. So this should
> probably live in clear_bss(), no?

This is how I understand the current order:
- The bss_decrypted section gets encrypted in sme_encrypt_kernel()
because it's part of the final BSS section.
- It is then remapped as unencrypted in sme_postprocess_startup().
- clear_bss() then clears it

When clear_bss() is called first, remapping it as unencrypted
scrambles that memory so it needs to be cleared again after remapping.
I could unconditionally clear it in the same place clear_bss() is
called now and not have it depend on encryption being enabled  The
other alternative would be for sme_encrypt_kernel() to skip it and
leave it as unencrypted from the beginning.